Linked Questions

87 votes
10 answers

New Gmail login system—going against conventional wisdom?

I noticed that the new gmail login asks for username first, and then confirms if such username exists, before asking for password input. Does this not go against conventional security wisdom to not ...
ataftoti's user avatar
  • 955
82 votes
10 answers

Generic error message for wrong password or username - is this really helpful?

It is really common (and I would say it is some kind of security basic) to not show on the login page if the username or the password was wrong when a user tries to log in. One should show a generic ...
Mirco's user avatar
  • 923
78 votes
3 answers

Does correcting misspelled usernames create a security risk?

Does correcting a misspelled username and prompting the user with a valid username introduce a security risk? I recently tried logging into facebook and misspelled my email. They prompted me with ...
GER's user avatar
  • 865
85 votes
4 answers

How to implement “forgot password” functionality?

For my project I need a "forgot password" functionality. I am not quite sure how to implement this kind of functionality yet so I was hoping to find some "best practice" on the internet but couldn't ...
Stefan Falk's user avatar
  • 1,067
43 votes
10 answers

How can I securely check if a username exists?

I'm working on the onboarding functionality of my web app and at some point I'm asking a new user to choose a username. When the user gets to this point, I have his/her email and a cellphone number ...
frenchie's user avatar
  • 1,091
17 votes
5 answers

Email instead of username

I am wondering about the security implications of using email as the main identifier via which a user logs in (with an associated password, of course). Can I treat it as I would a normal username or ...
Gregor Petrin's user avatar
7 votes
7 answers

Log in with email is more secure than a username?

Within the design of my web application, I am trying to now choose the final steps of the members profiles for security. *I need to choose if I should use a system which you login with a username or ...
Traven's user avatar
  • 906
7 votes
4 answers

Adding "Email or Username" in login page, is it safe?

Let's suppose a website has a login page with "Email or Username", and shows the username publicly to every user on that site. Does that make it easy for an attacker to hack other people's account?
Naman's user avatar
  • 175
11 votes
5 answers

Best practice for forgot password form, ok to leak that a given e-mail is invalid

On our forgot password reset form, is it ok to leak that a given e-mail address entered is invalid? Or should we always just return success and check your e-mail, even if the e-mail is not valid. I ...
Justin's user avatar
  • 1,247
8 votes
2 answers

Why do several bug bounties ignore user enumeration?

While viewing bug bounties, I noticed that most of the bug bounties list the user enumeration in the excluding list. For instance brute forcing user accounts, forget password forms would generally ...
BlueBerry - Vignesh4303's user avatar
4 votes
3 answers

Is it safe to generate a password for a user during sign up in a web application?

I'm working on updating a web application. It currently creates a password for a user during sign up. Is asking the user to create the password themselves safer than relying on a generated password?
Jamie Little's user avatar
2 votes
5 answers

Can extra loading times on login attempts be a security threat?

I have a web application built with PHP with a login page where the visitor is supposed to enter his / her account's email address and matching password. Since I'm using the PHP native (slow) hashing ...
Kid Diamond's user avatar
0 votes
2 answers

Is it bad if one uses the same email address on different sites/forums?

Is it bad practice if one uses the same email address on different sites and forums?
steven's user avatar
  • 1
2 votes
1 answer

What are the disadvantages of logging someone in on register?

So presuming a username/password authentication system (not an SSO) if you register a new user, what's the disadvantage of logging them in before verifying their account by email? Let's presume that ...
xenoterracide's user avatar
2 votes
1 answer

How can I design a password reset function, which does not reduce security for users who can remember their password?

We have a web app for which some users want to have a password reset function. I don't want to enforce a particular level of security for the users. So if a user picks a strong password which she is ...
kasperd's user avatar
  • 5,472